lines:= []string{

"\n",

"| Provisioner Tags | Job Tags | Can Run Job? |",

"|------------------|----------|--------------|",

"| Provisioner Tags | Job Tags |Same Org |Can Run Job? |",

"|------------------|----------|----------|--------------|",

}

kvs:=func(mmap[string]string)string {

}

for_,tt:=rangetestCases {

if!tt.expectAcquire {

}

s:=fmt.Sprintf("| %s | %s | %s |",kvs(tt.acquireJobTags),kvs(tt.provisionerJobTags),acquire)

iftt.unmatchedOrg {

}

s:=fmt.Sprintf("| %s | %s | %s | %s |",kvs(tt.acquireJobTags),kvs(tt.provisionerJobTags),sameOrg,acquire)

lines=append(lines,s)

}

t.Logf("You can paste this into docs/admin/provisioners.md")

1. If a job has any explicit tags, it can only run on a provisioner with those

explicit tags (the provisioner could have additional tags).

The external provisionerin the above example can run buildjobs with tags:

The external provisionerin the above example can run buildjobsin the same

organization with tags:

-`environment=on_prem`

-`datacenter=chicago`

-`environment=on_prem datacenter=chicago`

However, it will not pick up any buildjobs thatdo not have either of the

`environment` or`datacenter` tags set. It will also not pick up any buildjobs

from templates with the tag`scope=user` set.

from templates with the tag`scope=user` set, or buildjobs from templatesin

different organizations.

> [!NOTE] If you only run tagged provisioners, you will need to specify aset of

> tags that matches at least one provisionerfor _all_ template importjobs and

This is illustratedin the below table:

| Provisioner Tags| Job Tags| Can Run Job?|

| -----------------------------------------------------------------| ----------------------------------------------------------------| ------------|

| scope=organization owner=| scope=organization owner=| ✅|

| scope=organization owner= environment=on-prem| scope=organization owner= environment=on-prem| ✅|

| scope=organization owner= environment=on-prem datacenter=chicago| scope=organization owner= environment=on-prem| ✅|

| scope=organization owner= environment=on-prem datacenter=chicago| scope=organization owner= environment=on-prem datacenter=chicago| ✅|

| scope=user owner=aaa| scope=user owner=aaa| ✅|

| scope=user owner=aaa environment=on-prem| scope=user owner=aaa| ✅|

| scope=user owner=aaa environment=on-prem| scope=user owner=aaa environment=on-prem| ✅|

| scope=user owner=aaa environment=on-prem datacenter=chicago| scope=user owner=aaa environment=on-prem| ✅|

| scope=user owner=aaa environment=on-prem datacenter=chicago| scope=user owner=aaa environment=on-prem datacenter=chicago| ✅|

| scope=organization owner=| scope=organization owner= environment=on-prem| ❌|

| scope=organization owner= environment=on-prem| scope=organization owner=| ❌|

| scope=organization owner= environment=on-prem| scope=organization owner= environment=on-prem datacenter=chicago| ❌|

| scope=organization owner= environment=on-prem datacenter=new_york| scope=organization owner= environment=on-prem datacenter=chicago| ❌|

| scope=user owner=aaa| scope=organization owner=| ❌|

| scope=user owner=aaa| scope=user owner=bbb| ❌|

| scope=organization owner=| scope=user owner=aaa| ❌|

| scope=organization owner=| scope=user owner=aaa environment=on-prem| ❌|

| scope=user owner=aaa| scope=user owner=aaa environment=on-prem| ❌|

| scope=user owner=aaa environment=on-prem| scope=user owner=aaa environment=on-prem datacenter=chicago| ❌|

| scope=user owner=aaa environment=on-prem datacenter=chicago| scope=user owner=aaa environment=on-prem datacenter=new_york| ❌|

| Provisioner Tags| Job Tags| Same Org| Can Run Job?|

| -----------------------------------------------------------------| ----------------------------------------------------------------| --------| ------------|

| scope=organization owner=| scope=organization owner=| ✅| ✅|

| scope=organization owner= environment=on-prem| scope=organization owner= environment=on-prem| ✅| ✅|

| scope=organization owner= environment=on-prem datacenter=chicago| scope=organization owner= environment=on-prem| ✅| ✅|

| scope=organization owner= environment=on-prem datacenter=chicago| scope=organization owner= environment=on-prem datacenter=chicago| ✅| ✅|

| scope=user owner=aaa| scope=user owner=aaa| ✅| ✅|

| scope=user owner=aaa environment=on-prem| scope=user owner=aaa| ✅| ✅|

| scope=user owner=aaa environment=on-prem| scope=user owner=aaa environment=on-prem| ✅| ✅|

| scope=user owner=aaa environment=on-prem datacenter=chicago| scope=user owner=aaa environment=on-prem| ✅| ✅|

| scope=user owner=aaa environment=on-prem datacenter=chicago| scope=user owner=aaa environment=on-prem datacenter=chicago| ✅| ✅|

| scope=organization owner=| scope=organization owner= environment=on-prem| ✅| ❌|

| scope=organization owner= environment=on-prem| scope=organization owner=| ✅| ❌|

| scope=organization owner= environment=on-prem| scope=organization owner= environment=on-prem datacenter=chicago| ✅| ❌|

| scope=organization owner= environment=on-prem datacenter=new_york| scope=organization owner= environment=on-prem datacenter=chicago| ✅| ❌|

| scope=user owner=aaa| scope=organization owner=| ✅| ❌|

| scope=user owner=aaa| scope=user owner=bbb| ✅| ❌|

| scope=organization owner=| scope=user owner=aaa| ✅| ❌|

| scope=organization owner=| scope=user owner=aaa environment=on-prem| ✅| ❌|

| scope=user owner=aaa| scope=user owner=aaa environment=on-prem| ✅| ❌|

| scope=user owner=aaa environment=on-prem| scope=user owner=aaa environment=on-prem datacenter=chicago| ✅| ❌|

| scope=user owner=aaa environment=on-prem datacenter=chicago| scope=user owner=aaa environment=on-prem datacenter=new_york| ✅| ❌|

| scope=organization owner= environment=on-prem| scope=organization owner= environment=on-prem| ❌| ❌|

>**Note to maintainers:** to generate this table, run the followingcommand and

> copy the output:

1. Store the keyin a kubernetes secret:

kubectl create secret generic coder-provisioner-psk --from-literal=key1=`<key omitted>`

1. Modify your Coder`values.yaml` to include

```yaml

provisionerDaemon:

keySecretName:"coder-provisioner-keys"

keySecretKey:"key1"

1. Redeploy Coder with the new`values.yaml` to roll out the PSK. You can omit

`--version<your version>` to also upgrade Coder to the latest version.

```sh

helm upgrade coder coder-v2/coder \

--namespace coder \

--version<your version> \

--values values.yaml

kubectl create secret generic coder-provisioner-psk --from-literal=my-cool-key=`<key omitted>`

1. Create a`provisioner-values.yaml` filefor the provisioner daemons Helm

keySecretKey:"key1"

This example creates a deployment of 10 provisioner daemons (for 10

concurrent builds) authenticating using the above key. The daemons will

authenticate using the provisioner key createdin the previous step and

acquirejobs matching the tags specified when the provisioner key was

created. Theset of tags is inferred automatically from the provisioner key.

> Refer to the

> [values.yaml](https://github.com/coder/coder/blob/main/helm/provisioner/values.yaml)